Step 327. Gap Analysis Against the Winning Team — Dissecting "Why," Not "What"

Level 4 — Professional | Difficulty ★★★☆☆ | Estimated time: 2 days (half a day collecting Write-ups + one day building the comparison table and analyzing + half a day on the remediation plan)

Prerequisites: Step 326’s finals records — the day-of log, attempt history for unsolved problems, the secured top-team solutions. This chapter teaches not a new technique but an analysis frame — it’s a concept chapter.

What you need: the top 3 teams’ Write-ups (the competition’s official page, team blogs, CTFtime), your team’s competition records (Step 326’s deliverables), a document for the comparison table, and a Python environment. The gap-tally script is a measured tool you run with your own comparison results; quotations of Write-up content are marked as screen examples.
Caution: this chapter’s goal is neither admiration nor self-blame — the structural analysis of the gap and the resulting remediation plan are the only deliverables.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Reproduction training after the gap analysis is performed only with published problem files in a local environment.

When a competition ends, the top teams’ Write-ups get published. As you start reading, two emotions arise — "amazing" and "why couldn’t we?" Neither is analysis. The work here is not admiration but structural analysis of the gap. Why did they solve the same problem faster — that "why" comes in types, and each type has a different way to catch up.

Today you learn that analysis frame. Separate the gap into four types, build a comparison table for every unsolved problem, and derive a remediation plan per type. This frame is a tool reused on every top-team Write-up you’ll ever meet, not just this competition’s.

1. Learning Objectives

By the end of this chapter, you will be able to:

Define the four gap types (technique, tooling, perspective, operations) and apply them to real cases
Build a comparison table per unsolved problem: "my attempt / the correct solution / where I stalled / gap type"
Find more elegant solutions even in problems you solved and absorb them into your library
Separate technical gaps from operational gaps and build a different remediation plan for each
Convert the evasion "they’re just geniuses" into a list of "reproducible gaps"

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3 (gap tallying), a document tool (comparison table), a Write-up archive
Today’s command	`python step327_gap_analysis.py` — tally gap types and derive the remediation plan
Concepts needed	The 4 gap types, separating technical vs operational gaps, the reproducibility filter, library absorption
Today’s deliverable	A gap-analysis document (comparison table included) + a per-type remediation plan (learning, tooling, operations improvements)

2-1. The Four Gap Types — The Classification Table of "Why"

The same "couldn’t solve it" has different prescriptions for different causes. The following four questions are themselves the classification table.

Type	Diagnostic question	Symptom	Prescription
① Technique gap	Did they know a technique we didn’t?	The write-up’s technique is one you’ve never seen	→ learning list: study the principle + special training on similar problems
② Tooling gap	Same technique, but was it tooled?	You know the technique, but they took 40 minutes, you took 4 hours	→ tooling list: commit it to the library as a script/template
③ Perspective difference	Was the angle on the problem different?	You know the technique but never thought to "look at that there"	→ perspective training: reconstruct the write-up’s thought path
④ Operations gap	Was team operations (division of labor, sharing) different?	The problem was solvable but time and information didn’t connect	→ operations improvements: revise team rules

Why this classification matters: apply ②’s prescription to ① (trying to tool a technique you don’t know) and nothing happens; apply ①’s prescription to ④ (trying to solve an operations problem with study) and the gap stays. A remediation plan without types is not a plan — it’s a wish.

2-2. Technical Gaps vs Operational Gaps — Two Different Axes

Bundle the four types more coarsely and you get two axes. ①②③ are technical gaps — differences in individuals’ competence at facing problems. ④ is an operational gap — a difference in the team system that connects competence to score.

Why is this separation needed? Because the two have different recovery curves. Technical gaps are closed over weeks to months through study, special training, and reproduction. Operational gaps reflect into the very next competition by revising a rule in a single meeting. Mix the two axes in the analysis document and "what to do by the next competition" blurs into "what to do this quarter," hazing the plan.

Here’s a fact many teams discover at real competitions — a large share of the total-score gap comes from operations, not technique. When a team that could solve the same problem burns two hours on duplicate assignments, failed information sharing, or scoreboard addiction, those two hours get recorded as a technical gap while their substance is operational. This is why, when writing the comparison table, you distinguish "couldn’t solve it" from "left it unsolved and untouched."

2-3. The Reproducibility Filter — The Antidote to "Genius Theory"

Here’s a warning: reading Write-ups, you’ll want to flee to the conclusion "they’re just geniuses." The problem with this conclusion is not that it’s wrong but that it’s action-impossible. Nothing to do comes out of "genius."

The antidote is the reproducibility question — "can we reproduce and close this gap?" Dissect a write-up and most gaps decompose into "combinations of things we also know + much faster tooling." Truly irreproducible gaps do exist (problems requiring years of specialized background), but that must be the analysis’s conclusion, never its first reaction. Take only the reproducible gaps — this sentence is this chapter’s working rule.

2-4. Compare the Solved Problems Too — Absorbing Elegance

Gap analysis is not work for unsolved problems only. Comparing solved problems often yields the bigger harvest. If someone reached the same flag by a shorter path, with a more general-purpose script, that solution is an upgrade patch for our library.

The comparison criteria are three — path length (number of steps), reusability (can it be templated?), robustness (does it survive problem mutations?). Where our solution loses on these three criteria, commit the winning team’s approach to our library. Record the source alongside — it’s both a record of the absorption and, later, navigation for reading that team’s other Write-ups first.

3. Follow Along

3-1. Collecting Write-ups — Gathering the Analysis’s Raw Material

Collect the top 3 teams’ Write-ups. Four channels — the competition’s official page (winning solutions published), team blogs, the competition’s CTFtime page (a collection of Write-up links), and for a finals, your notes from the post-awards solution presentations (secured in Step 326).

The collection rules are the same as Step 298’s past-exam collection — preserve the originals, organize folders by problem, record sources. One thing differs: this time, reading the Write-ups first is the purpose. You’ve already met the problems at the competition, so you can read closely with no worry about losing training value.

3-2. Building the Comparison Table — Four Fields per Problem

For every unsolved problem, fill one row of the comparison table. Four fields — my attempt / the correct solution / where I stalled / gap type.

Comparison-table example (screen example):

[web-chain (web, 300 pts)]
- My attempt: found the SSRF vulnerability, progressed as far as internal port
  scanning. Handed off after 3 hours; unsolved
- Correct solution (winning team): a 3-stage chain of SSRF → internal Redis access
  → session tampering → admin RCE
- Where I stalled: found Redis but dismissed it as "just a cache." Never saw the
  chain's next link
- Gap type: ① (didn't know the SSRF→Redis chain pattern) + ③ (lacked the perspective
  that connects findings)

[pwn-heap (pwn, 350 pts)]
- My attempt: solved in 4 hours via tcache poisoning
- Correct solution (winning team): same technique, but 40 minutes with their own
  template script
- Where I stalled: didn't stall — but 6x slower
- Gap type: ② (same technique, different tooling)

How to read it: look at the contrast between the two rows. web-chain is an "unsolved problem," but analysis shows an overlap of two types; pwn-heap is a "solved problem" but shows a clear ② gap. The standings record only "solved or not" for both, but the comparison table records entirely different prescriptions. This is the resolution of gap analysis.

3-3. Tallying the Gaps — Viewing Them by Type

Once the comparison table stacks up, tally by type to see the structure. Save as step327_gap_analysis.py — replace ROWS with your comparison table.

# step327_gap_analysis.py — gap-analysis comparison-table generator vs the winning team
# gap types: 1 unknown technique / 2 tooling gap / 3 perspective difference / 4 team operations gap

# (problem, category, my attempt summary, winning-team solution summary, stall point, gap type, winner minutes, my minutes)
ROWS = [
    ("pwn-heap",   "pwn",   "tcache poisoning attempt",   "same, but 40 min with a template script", "speed",                 2, 40,  240),
    ("web-chain",  "web",   "single SSRF attempt",        "SSRF→Redis→RCE 3-stage chain",            "couldn't build chain",  1, 90,  None),
    ("crypto-aes", "crypto","suspected an ECB oracle",    "CBC bit-flipping, library functions used","type ID failed",        1, 35,  None),
    ("rev-packed", "rev",   "manual unpacking attempt",   "automated with a dynamic-dump script",    "no tooling",            2, 50,  150),
    ("foren-mem",  "foren", "Volatility default plugins", "custom profile + timeline correlation",   "different perspective", 3, 60,  None),
]

TYPE_NAME = {1: "1 unknown technique", 2: "2 tooling gap", 3: "3 perspective difference", 4: "4 team operations gap"}

print("=== Gap Comparison Table ===n")
print(f"{'problem':<12}{'category':<8}{'stall point':<22}{'gap type':<26}{'winner':>8}{'ours':>8}")
from collections import Counter
types = Counter()
for name, cat, mine, win, stuck, t, wt, mt in ROWS:
    types[t] += 1
    m = f"{mt}m" if mt else "unsolved"
    print(f"{name:<12}{cat:<8}{stuck:<22}{TYPE_NAME[t]:<26}{wt:>6}m{m:>9}")

print("n=== Gap-Type Tally ===")
for t, k in sorted(types.items()):
    print(f"  {TYPE_NAME[t]}: {k}")

print("n=== Per-Type Remediation Plan (auto-derived) ===")
plan = {
    1: "learning list — study the technique's principle + special training on 5 similar problems",
    2: "tooling list — turn the solution into a script/template and commit it to the library",
    3: "perspective training — re-read the winning write-up from the problem, reconstructing 'why did they look there?'",
    4: "operations improvements — revise division-of-labor & information-sharing rules in a team meeting",
}
for t, k in sorted(types.items()):
    print(f"  {TYPE_NAME[t]} ({k}) -> {plan[t]}")

solved_by_winner = [r for r in ROWS if r[7] is None]
print(f"nproblems the winner solved and we didn't: {len(solved_by_winner)} — all registered to the reproduction list")
for r in solved_by_winner:
    print(f"   - {r[0]} ({r[1]})")

Here’s the measured output from running it with the comparison-table data above:

=== Gap Comparison Table ===

problem     category stall point            gap type                   winner    ours
pwn-heap    pwn      speed                  2 tooling gap                 40m    240m
web-chain   web      couldn't build chain   1 unknown technique           90m unsolved
crypto-aes  crypto   type ID failed         1 unknown technique           35m unsolved
rev-packed  rev      no tooling             2 tooling gap                 50m    150m
foren-mem   foren    different perspective  3 perspective difference      60m unsolved

=== Gap-Type Tally ===
  1 unknown technique: 2
  2 tooling gap: 2
  3 perspective difference: 1

=== Per-Type Remediation Plan (auto-derived) ===
  1 unknown technique (2) -> learning list — study the technique's principle + special training on 5 similar problems
  2 tooling gap (2) -> tooling list — turn the solution into a script/template and commit it to the library
  3 perspective difference (1) -> perspective training — re-read the winning write-up from the problem, reconstructing 'why did they look there?'

problems the winner solved and we didn't: 3 — all registered to the reproduction list
   - web-chain (web)
   - crypto-aes (crypto)
   - foren-mem (foren)

How to read it: read what the tally is saying. This example team’s gaps are two ①s, two ②s, one ③, zero ④s. Two conclusions. ① The gap to the winning team is not "genius" — all five problems decomposed into absences of known techniques or absences of tooling. Especially the two ②s (pwn-heap 40 min vs 240 min, rev-packed 50 min vs 150 min) — same technique, different time. Two template scripts made a 5-hour-30-minute difference, and that time could have engaged one more of the three unsolved problems. ② The remediation plan branches automatically by type — two learning-list items, two tooling-list items, one perspective training. These lists are the input of the next training cycle.

3-4. Analyzing the Operational Gap — Points Outside the Points

Type ④ is found outside the comparison table. If top teams’ operating methods were published in retrospectives or presentations, compare them against your day-of log (Step 326).

Operational-gap comparison table (screen example):
| Item | Winning team (public retrospective) | Our team (day-of log) |
| Division of labor | Category owners + one full-time reviewer | Category owners only, irregular review |
| Info sharing | Mandatory immediate posting to the shared board | Posted to threads, but 2 omissions |
| Scoreboard | Fixed checks at 1-hour intervals | Only during meetings (3–4h) — we're stricter |
| Closing management | A dedicated solution-tidying role 30 min before the end | 60 min of tidying after the end — logged as operations-heavy |

How to use this table: not every difference is a gap — like the scoreboard row, some of our operations are better. Gap analysis’s purpose is not self-blame but adoption. If "full-time reviewer" and "separate closing-tidying role" are adoption candidates, those two lines are the revisions of the next competition’s operations plan.

3-5. Completing the Gap-Analysis Document — Deriving the Three Lists

The analysis’s final deliverable is one document. Structure: comparison table + tally + three lists.

Gap-analysis document structure (screen example):
1. Comparison table (3-2) — every unsolved problem + solved problems where a better
   solution existed
2. Type tally (3-3) — the gap's structure at a glance
3. Remediation plan, three lists:
   - Learning list: type-① techniques — principle-study material + 5 similar problems each
   - Tooling list: type-② techniques — templating specs + library commit schedule
   - Operations improvements: type-④ — rule-revision sentences to apply from the next competition
4. Reproduction list — every problem the winner solved and we didn't, with owner and deadline

The document’s completion condition is not "readable" but every list’s first item has a next action attached. The learning list’s first technique has a study-material link; the tooling list’s first item has a template spec; the operations improvements have a draft revision sentence. The end of analysis is not understanding — it’s an action list.

4. Missions & Exercises

Mission — Complete the Gap-Analysis Document

Collect the top 3 teams’ Write-ups and organize them by problem (3-1).
Build the comparison table (my attempt / correct solution / where I stalled / gap type) for every unsolved problem.
Compare the solved problems too — register any more elegant solution found as a library-improvement item.
Feed the comparison table into step327_gap_analysis.py to derive the type tally and remediation plan.
Write the operational-gap comparison table (3-4), and complete the remediation plan as three lists (learning, tooling, operations improvements) — attach a next action to each list’s first item.

Exercises

Exercise 1. How are ① technique gaps and ② tooling gaps distinguished on a write-up? Explain each one’s diagnostic question and the difference in prescription.

Exercise 2. Explain why the conclusion "they’re just geniuses" is a problem from an analysis standpoint, using the concept of the "reproducibility filter."

Exercise 3. In 3-3’s measured output, estimate in time terms the effect of the two ② tooling gaps (pwn-heap 240m→40m, rev-packed 150m→50m) on the total score. If that time had been secured, what could have changed?

Exercise 4. Explain why solved problems are compared too, together with the three comparison criteria (path length, reusability, robustness).

5. Model Answers & Completion Criteria

Mission Model Answer

Check against these verification criteria.

Collection completeness: are the top 3 teams’ Write-ups organized by problem with sources recorded — and for a finals, were solution-presentation notes included?
Comparison-table resolution: is every unsolved problem’s "where I stalled" written as a concrete point ("found Redis but dismissed it as a cache"), not an abstract expression ("didn’t know")?
Grounds for type judgment: was each gap type judged as the answer to a diagnostic question — are there no rows left without a type?
Solved-problem comparison: were cases of better solutions found registered as library-improvement items?
Plan actionability: does each of the three lists’ first item carry a next action (material link, spec, revision sentence), and does every reproduction-list item have an owner and deadline?

Exercise Answers

Answer 1. The core of the distinction is "did we know the technique?" If the write-up’s core technique is one you’ve never seen, it’s ①; if you know the technique but their execution is overwhelmingly faster, it’s ②. As diagnostic questions: ① asks "did they know a technique we didn’t?", ② asks "same technique — but was it tooled?" The prescriptions differ completely — ① needs learning (understanding the principle + similar-problem training), while ② is engineering (scripting/templating existing knowledge). Apply engineering to ① and you don’t know what to build; apply learning to ② and you’re wastefully re-learning what you already know.

Answer 2. The conclusion "genius" is analysis terminated — that word contains no action. The reproducibility filter is the question that blocks that termination: "can we reproduce and close this gap?" Every gap that passes the filter converts into an action list — unknown techniques go to the learning list, tooling to template specs. In practice, dissecting write-ups shows most gaps decompose into "combinations of the known + fast tooling," so the filter’s pass rate is high. Even if a truly irreproducible gap remains, it must be the conclusion after decomposing the whole, never the first reaction — first-reaction "genius theory" is analysis avoidance, and the filter is the working rule that blocks that avoidance.

Answer 3. Time conversion: 200 minutes saved on pwn-heap, 100 minutes on rev-packed — 300 minutes total = 5 hours saved. In this competition our team’s unsolved count was 3 (web-chain, crypto-aes, foren-mem), and the winning team’s times on those were 90, 35, and 60 minutes — 5 hours is enough time to engage and complete at least two of them. Of course, tooling must be finished before the competition, so "that day’s 5 hours" is an asset carried over to the next competition’s score. This calculation becomes the tooling list’s prioritization basis — the numbers show that two templates are worth two problems’ point values.

Answer 4. If comparing unsolved problems is analysis of "what we failed," comparing solved problems is discovery of "what we could have done better" — and the latter changes score more often in practice. Three criteria. Path length: a solution reaching the same flag in fewer steps saves competition time. Reusability: a templated solution works as-is on the same type at the next competition. Robustness: a solution that works even when the problem mutates covers the whole type. Where our solution fails these criteria, it’s marked "correct but improvable," and the winning team’s approach gets committed as the library’s upgrade patch. Half of gap analysis is the analysis of defeat — but the other half is the inspection of victory.

Completion Criteria Checklist

[ ] I collected the top 3 teams’ Write-ups and organized them by problem
[ ] I built the comparison table (my attempt / correct solution / stall point / gap type) for every unsolved problem
[ ] I compared solved problems too and registered better solutions as library-improvement items
[ ] I derived the gap-type tally with the script and read the structure
[ ] I wrote the operational-gap comparison table and chose rules to adopt
[ ] I completed the remediation plan’s three lists (learning, tooling, operations improvements)
[ ] I attached a next action to each list’s first item
[ ] I assigned an owner and deadline to every reproduction-list item

6. Common Pitfalls & Fixes

Wall 1. The winning team’s Write-up is too abbreviated to follow

Symptom: a line like "here we connect the standard chain" is actually three steps.

Cause: top teams’ Write-ups assume readers at their own level — the abbreviation isn’t intentional; to them it’s "obvious."

Fix: filling the abbreviations is itself the analysis training. Three steps. ① Mark the abbreviated points — count "how many steps is this one line really?" ② Reverse-trace each step’s basis — why does this step work? Confirm against the software’s docs and source. ③ Reproduce locally with the filled-in content. Where you stall here is the exact location of a type-① gap — a write-up’s abbreviation is not a bug but a measuring instrument for our gaps.

Wall 2. Every row’s gap type ends up ① (unknown technique)

Symptom: the table’s type column fills with nothing but ①.

Cause: usually a resolution shortage in the analysis — gaps lumped under "didn’t know" often hide ②③④ inside.

Fix: ask each row a second question. "Did we truly not know the technique — or did we know it and fail to recall it (③)?" "Did we recall it but our hands were slow (②)?" "Did we never even get to attempt it for lack of time (④)?" ④ in particular is confirmed not in the comparison table but in the day-of log — if the time invested in that problem was under 30 minutes, it’s not a technical gap but an allocation gap. Types piling onto one side is itself a warning signal of analysis quality.

Wall 3. The remediation plan grew big enough to fill the entire next season

Symptom: 15 learning-list items, 10 tooling-list items — doing it all would take half a year.

Cause: normal — good analysis always overproduces work. The problem is the absence of priorities.

Fix: cut with two criteria. ① Frequency weighting — the probability the technique/type appears at next season’s competitions (grounded in Step 298’s past-exam trend data). ② Cost-effectiveness — if two tooling items take a day each but one learning item takes two weeks, tooling goes first. Recall Step 295’s single-goal principle — don’t do everything on the list simultaneously; execute only this cycle’s 1–2 items. The rest go not to "someday" but to "the priority queue" — being in a queue means not discarded but ordered.

Wall 4. A teammate refuses the analysis itself — "we lost, why revisit it?"

Symptom: post-competition fatigue and defeat make the gap-analysis meeting fail to convene.

Cause: the emotion is normal; it’s a timing problem. And if the analysis feels like a "who underperformed?" session, anyone would refuse it.

Fix: two devices. ① Time spacing — right after the competition, hold only the debrief meeting (Step 326, 15 minutes), and schedule gap analysis a few days later. However, securing raw material (the log, Write-up collection) must finish that day — analysis can wait, but records vanish if postponed. ② Pre-announcing the rules — fix in advance that the analysis’s purpose is not "contribution evaluation." The comparison table carries problems and types, not names. The object of analysis is the gap, not the teammate.

Wall 5. We analyzed, but we lose the same way at the next competition

Symptom: the gap-analysis document exists, but behavior didn’t change.

Cause: the document’s completion condition was violated — either "next action on each list’s first item" was missing, or it existed but execution was never tracked.

Fix: connect the document to the training cycle. ① Learning and tooling lists count as a "plan" only when assigned real hours in the training schedule (Step 325’s TASKS format). ② Operations improvements must enter the next competition’s day-of strategy document as rule sentences — if the improvement "full-time reviewer" isn’t translated into the next strategy document as "on each solve, another teammate verifies the flag before submission," it won’t be executed. Add a column to the end of the analysis document tracking "where did each item in this document go?" — the end of analysis is not the document but the behavior the document changed.

7. Summary

Today’s Concepts

Concept	One-line explanation
The 4 gap types	① unknown technique ② tooling gap ③ perspective difference ④ team operations gap
Technical vs operational gaps	Two axes with different recovery curves — separate study problems from rule problems
Reproducibility filter	The question "can we close it?" — converts genius theory into an action list
Comparison table	Four fields: my attempt / correct solution / stall point / gap type
Solved-problem comparison	Path length, reusability, robustness — the inspection of victory
The three lists	Learning list, tooling list, operations improvements — the end of analysis is action

Today’s Tools & Commands

Tool/command	What it does
`python step327_gap_analysis.py`	Tally comparison-table types, branch the remediation plan, derive the reproduction list
Comparison-table template	Four fields per problem — stall points written as concrete points
Operational-gap comparison table	Top teams’ public operations vs our day-of log
Abbreviation-tracing procedure	Mark abbreviated points → reverse-trace the basis → reproduce locally
Action-tracking column	Tracking which plan/document each analysis item flowed into

The Core Instinct

The most dangerous enemies in gap analysis are not the winning team but two emotions — admiration and self-blame. Admiration turns analysis into sightseeing; self-blame turns analysis into punishment. This chapter’s frame is the third road between them — decompose the gap into types, and there’s always something we can do. Unknown techniques can be learned, tooling can be built, perspectives can be trained, operations can be fixed by revising rules.

And this frame’s real value is reuse. The comparison-table template and tally tool you made today work as-is at the next competition — and in front of the Write-ups of world-ranking teams at international competitions. The bigger the gap, the bigger the analysis’s value — the stronger the opponent, the better a textbook their Write-up is.

Once every box is checked, Step 327 is complete.

Step 327. Gap Analysis Against the Winning Team — Dissecting “Why,” Not “What”